W��j"7DA���S�5}�o�o�Ǔ������c�3P~kT �#F�6w��y��`E��j`Uv�MF�#�`�:�t�[�.�,�,SQ`��0�`��,����:����B3r�g%� A���+gV�*�_��D��A+j'0����N��g�ͳ��TKW,�T��叏��e����f�(���!S\�tq0�����N��mu����B&A��� �f��\<�6��K��H�2��%��������ʞ�%����C�'Y���p�;)�C3��B��5[��)�����z�,?.�Vqb��c@8�vaSr�Jr�`������7�5[��C��K:�Ai��Tж��R����PD���y��ůIQ��(�6�ƽ������w{�� DMd OYz$$U{G0Ҕ���tN���s ֏_�p^����=�vJ^!f�8z��F��'�E�����%���5���p�Yԥ��U�k�`1�,�A�<�)�t���Ou���?���q�"dem\]�P��%}��q8R��:�ħ `2���8�6m��R��yq�����q�p;�����VKtw�nY��Q��&ԭ���q�ƨ!�����1A���5�)I�_�S|�H�J*|F �!��[���L��J���cR���d�u� ���$��Vи������*�p �81�2 �,vM���"p�X*�_�}e�{G<q�]cȸ������s�sd��lB�͋�T?p�fӦ_:s�{���-2�w�(Ṫ������+u�X/@,����!n�����}+��K0�|�ξv s�=�m5�C��@8�};ɢ�?7q�{�20qay��g� V�a��N1<���x߬i����I/��^�1��Ov�q�������&�_��ኖ�/d�K)ji��8�����HB�48�����l)B�<�;�Y{�Q!Z��s3)o�@�ݓws�������EZɁ`I��eq��兹�f���o6Y�R�t��7�tl}'�-;��Dp.:��y�8D�+�D����i^;释Q��L��"�}FB���[�zA�ɻ�2D����̩ziߧ��c�6/���(}�&�Y��פ~��3�r^�R�_[� trI��[��;Y��1�����|�랽��)�]S�T��0�*����tg�����j{ ��Y{kR��9<��痲��k&��2!�Ï���y�NU�2��W9_()�`��w��vyf>Q �uCX���_N|#?��!��w�[������c�_�˴��˟�g�k�_�����R�~k�n��qW��p�\���I��hegY\�Q�spS&N���JG�o.MF�1�a��^d��m��e�V�}�7�������^.^�`v^�ٮ�p� r�;A�a�ض�a?�?�c�e:����j���� a���EJ��δ8��eEɇfNel!ǎ�j��I�B�T|`�dy���lS Ls��%>s�10��'��<���&�\��i�8�K�M��+�o�=%��'��k�⪀�cʢ>�QB�:3Z���s�?t1]�ڞj1 ���k/B�pt��67#%�KE�K1��0�|��z��Uޢ���.� ��`��Y��E�,�Y���Q =�WZ�{�nY�,������-8#Sk���ų������O;���6z��[6!H56~����G����r ���NͲ�Z,���9��I�]���|���LS6c���!��ךc%`v��f̓�`�l�ltQ��������z�}�r&�m6Pй�VO4�8/�55 ԊG5����5s����)i(��[SL��1R��=p����1Ô;Q�|��y���N~���1z�*!��JFЕ�^�Y����������6G�K6��`5"Zw�������{������X1����r��%i�>��:ި���H�L��|Gc똹XI>ߎ,Z��=κ�a���� �_�5���)vu3s�j?*�?�����%����\��eS�� -������&c����Z�\�E����XUE�J]�;,mT(қG(Sϋem��7���x&v����Ǭ���i��~��u%��XԂgL��c��%�+���adj�+������mA�1)V���,�7@�������_B�I�t��!��:J�'8}��[�����.0�P!z�F�U ��du��b�e�nk�CX��#����.���w�26��sVu0��X ���ɤ��1�@��%^7�R攵:�M�.6C����nA <���UZ���5b{=��zءo~��I�l�Q�G��&v�hYC��l ��,���0Q�V�=(\w�������s�3�E{�P��Q*���[��81LK��{�&%V� *�$B��,�CA��C�}����R�UB,�o��hNv���$<���� 4fT����jÃ����r|���k��H6�C拼:��`��`�t)�pk���b�翬�6�)E��+n��� �y2�Sݒ���E�R{��r_sA#��U/�����U_it"DO��G^�3y/���@��S���/\j�䊤z9е�{! ��������?,1V�)�0��;dK�5�f:�0�̬s�@Lk���=5�:f�c�#0:��wiv��b����N���ӏT�d�J�'d�����jD� ��Kn�) ŕ��0��Z ��X�oKpآJ����� �l�.����.����ӣ��H��˃��Q�]���R��N��O1u����H�� �A�fj��Z KV���e�ga� �Y��`�Ď�)Hw�/��W��Kc#bȱkj�߰O��1�`����P�x#�ɣ��P.C���W�3��K|�K*c� 9�"��F�K������1�����'��y{�nPk?�x�I?�#{�T`�3z+�j�%1r�pb�D��%��is����L�KA�]���$�Z���fR�ї:��J�����J�������*i0Dю��VW�o(W���$u�TA�;���Noت�����?��I�� M�n�.�m�o��h�o �����M|q���FK�"��mMu.�S35u+,�ѠGGo�5������y ����*�U%�d��#_�+6�ڡt�
Behavioral task
behavioral1
Sample
5d6a2f814eb2841c071e66c3c658e2bb_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
5d6a2f814eb2841c071e66c3c658e2bb_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
5d6a2f814eb2841c071e66c3c658e2bb_JaffaCakes118
-
Size
724KB
-
MD5
5d6a2f814eb2841c071e66c3c658e2bb
-
SHA1
97196d605f4e2156939830e1563c6321461a7d25
-
SHA256
9b804bf4d05d055a06c4477ac6c0bfc4820555c040d9efdbf4a7f548bbc2f130
-
SHA512
a097b95e58482f8e72641d6416db1b2393d362cb9ad5f65c118116535f77edc753f47a7138fdda626ecab805c733002cb36ef0015ec41eb658ba7ae0be4c2009
-
SSDEEP
12288:vIpjTfkz3zZ71frSoveYnVNbWT/A5YoDQnMIKu/2RfTJAQ5XHehhurdO04B7PkeK:wp0BveYVNic5bDQMIf2YQ5XHe6BO04pM
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5d6a2f814eb2841c071e66c3c658e2bb_JaffaCakes118
Files
-
5d6a2f814eb2841c071e66c3c658e2bb_JaffaCakes118.exe windows:4 windows x86 arch:x86
f620dd536651dbd070fc1960864faccc
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord644
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 648KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 434KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 128KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 712KB - Virtual size: 709KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE